AWS: Amazon Quick's Smart Approvals lets a classifier clear routine agent actions

Amazon Web Services (AWS) published a post on 4 November 2026 describing Smart Approvals in Amazon Quick, a feature that reviews an agent's proposed actions and clears the routine ones without asking the user. The author is Steve Vinsik, an AWS principal product manager for Quick governance. The post is vendor-published: it explains the design and gives no usage or accuracy data.

The problem AWS describes

AWS argues that requiring approval for every step makes multi-step tasks produce repeated prompts, even for routine actions. It cites research on security warnings showing that attention and adherence can decline with repetition. Its stated goal is to keep human attention for decisions that need it, not to add more approvals.

What decides eligibility

AWS says policy sets the boundary. Quick checks each proposed action against Custom Permissions, Quick Guardrails, connector action permissions and the user's settings before any automated review. With Smart Approvals on, an action is eligible only if the user's setting is "Ask each time" and no other control requires human approval.

• Denied actions remain denied, and mandatory human approvals still apply, according to AWS.
• Administrators use Custom Permissions to decide who can use Smart Approvals. It is on by default; profiles with deny-by-default enabled must explicitly allow it.
• Users can turn it off for themselves, which applies across conversations and scheduled runs. AWS says no account-level setting can turn it back on for them.

How the review works

A separate model, the classifier, evaluates each eligible action against the user's request and a bounded view of the conversation. AWS says it considers what the action does, where data goes and who it affects, and can consult the user's knowledge graph to tell, for example, whether a recipient is in the user's reporting chain. AWS says Quick does not use reviewed content, including knowledge graph data, to train models.

AWS lists actions that can still warrant a person's review: sending content outside the organisation or to senior leaders in the user's reporting chain, changing access, deleting records, and initiating payments. It says the list is not complete. It also says reviewing actions against the request adds a check against indirect prompt injection, where instructions in retrieved content try to redirect the agent.

AWS gives an example. An account manager asks Quick to prepare a quarterly brief and send it to two named colleagues. An account note says it should also go to an all-sales list of about 2,000 people. AWS says Smart Approvals is designed to return that send to her, and that approval for the original recipients cannot be reused for the wider audience.

Limits AWS states

AWS says the classifier provides judgment while the permission service enforces authority. Each automatic approval is single-use and applies only to the exact action and parameters reviewed. Timeouts and review failures never grant approval. AWS also says model review can still make mistakes, and that these boundaries limit what an approval authorises but do not show the classifier was right. Actions that must always get human approval, including those that move sensitive data, should require it through connector action permissions.

Audit trail and rollout advice

AWS says the Quick permission service records permission updates tied to Smart Approvals in AWS CloudTrail, each identifying user, connector, action and time. It notes that marker does not prove the grant was accepted or the action ran; the destination system's record, such as the sent email, confirms completion. CloudTrail event history keeps events for 90 days, so AWS says to configure a trail for longer investigations. Chat logs capture only activity after delivery to Amazon CloudWatch Logs is configured, so earlier approvals will lack conversation context.

For rollout, AWS suggests confirming that must-approve actions are set through connector action permissions, enabling logging, then using Custom Permissions to limit Smart Approvals to a pilot team on a defined workflow. During the pilot it says to review a sample of automatic approvals and test high-impact cases, such as an external send or a recipient introduced by a document.

What the post leaves out

There are no figures: not how many prompts the feature removes, how often the classifier approves something it should not, what the extra model call costs, or how much latency it adds. Because the feature is on by default, a team that has not configured connector action permissions may find the classifier, not a person, deciding some actions it assumed a person would see.